Harden local runtime safety and error handling

cmd/qfs/versioning_api_test.go

@@ -3,10 +3,12 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"git.mchus.pro/mchus/quoteforge/internal/config"
@@ -290,6 +292,88 @@ func TestConfigMoveToProjectEndpoint(t *testing.T) {
 	}
 }
 
+func TestVendorImportRejectsOversizedUpload(t *testing.T) {
+	moveToRepoRoot(t)
+
+	prevLimit := vendorImportMaxBytes
+	vendorImportMaxBytes = 128
+	defer func() { vendorImportMaxBytes = prevLimit }()
+
+	local, connMgr, _ := newAPITestStack(t)
+	cfg := &config.Config{}
+	setConfigDefaults(cfg)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
+	if err != nil {
+		t.Fatalf("setup router: %v", err)
+	}
+
+	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"Import Project","code":"IMP"}`)))
+	createProjectReq.Header.Set("Content-Type", "application/json")
+	createProjectRec := httptest.NewRecorder()
+	router.ServeHTTP(createProjectRec, createProjectReq)
+	if createProjectRec.Code != http.StatusCreated {
+		t.Fatalf("create project status=%d body=%s", createProjectRec.Code, createProjectRec.Body.String())
+	}
+
+	var project models.Project
+	if err := json.Unmarshal(createProjectRec.Body.Bytes(), &project); err != nil {
+		t.Fatalf("unmarshal project: %v", err)
+	}
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("file", "huge.xml")
+	if err != nil {
+		t.Fatalf("create form file: %v", err)
+	}
+	payload := "<CFXML>" + strings.Repeat("A", int(vendorImportMaxBytes)+1) + "</CFXML>"
+	if _, err := part.Write([]byte(payload)); err != nil {
+		t.Fatalf("write multipart payload: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close multipart writer: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/projects/"+project.UUID+"/vendor-import", &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for oversized upload, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "1 GiB") {
+		t.Fatalf("expected size limit message, got %s", rec.Body.String())
+	}
+}
+
+func TestCreateConfigMalformedJSONReturnsGenericError(t *testing.T) {
+	moveToRepoRoot(t)
+
+	local, connMgr, _ := newAPITestStack(t)
+	cfg := &config.Config{}
+	setConfigDefaults(cfg)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
+	if err != nil {
+		t.Fatalf("setup router: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/configs", bytes.NewReader([]byte(`{"name":`)))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for malformed json, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if strings.Contains(strings.ToLower(rec.Body.String()), "unexpected eof") {
+		t.Fatalf("expected sanitized error body, got %s", rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "invalid request") {
+		t.Fatalf("expected generic invalid request message, got %s", rec.Body.String())
+	}
+}
+
 func newAPITestStack(t *testing.T) (*localdb.LocalDB, *db.ConnectionManager, *services.LocalConfigurationService) {
 	t.Helper()